From patchwork Wed Dec 7 22:52:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Reinette Chatre X-Patchwork-Id: 31083 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp444382wrr; Wed, 7 Dec 2022 14:56:02 -0800 (PST) X-Google-Smtp-Source: AA0mqf7BITYhOJaJQgc0Lnvw5wp8hrfxQYA5jXtCNfCZOeajwCtVAIK0ji6rjUrV7bzm2zH2tezi X-Received: by 2002:a17:906:404:b0:781:f54c:1947 with SMTP id d4-20020a170906040400b00781f54c1947mr66783976eja.69.1670453762705; Wed, 07 Dec 2022 14:56:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670453762; cv=none; d=google.com; s=arc-20160816; b=jh1fDEykEL7Kb+KlWnLIq2uljxLYw1/5cAgav0gTGLQqffuOd/twtyGq+nNSjbnoD5 RzOeidnopVtEJLvYyp6kmEjzb1iPo+wK0/HnJvV/o8gMjKo2QgEHYp/d582oGDypPdGI WSh6w116lNXYk1If3mNxKjXpISzmU23MOvr9TF4VYyrbgc5mvNzooxYX9pxhQU4qdW6/ 2VLKZhMp5/e5wqjxt0iei48wqOSt3ZvOm9uRuqvjDcWHRlkkOYDdnyiHJR43hLcE9jup ExQ1HIl1IyTo0+glxS4y+MjPjCQkKFZF8qbSdoDHLPpDYcMXM945NtBE8bHQTgwTak03 9cww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=Sya1E12Bna9w/J6txGwm2i2u5Dts3HwmOBmrRwfDwLo=; b=DNcRWxc4JBRPrE4sLGd0SN689XhqDqAXruBLeQtfOt8r9LkzkCVEPtclqZx81vDMTl MFFvMpu++kenSiKCURguSTBUQ9A3QGTawVB4ql4xT4pTpsSPjMAbyxGETddw6Eu6mmdl nBt6N/isk8eYXvtC4KD3AGOCi1VIX0tzFsHGXVXFqHLCWwEcQB0MOVywEbjENCNXIPR+ C2Evg+JmKHpSTP+HYU+pqkkpeznCVgpE2gUZCye5husZ6eQADTLvowTpXdiMnbt68n8z wHylbwO5cHXjvTYsECZaDsM7X5IDIWzLPyf6Jf6bcxxBQCwm5IknAMXg+5Vqgv0iEAwb Rlew== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=DClaJA0v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z8-20020a056402274800b00469f6d1a3c1si6111410edd.130.2022.12.07.14.55.22; Wed, 07 Dec 2022 14:56:02 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=DClaJA0v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229868AbiLGWwf (ORCPT + 99 others); Wed, 7 Dec 2022 17:52:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229470AbiLGWw3 (ORCPT ); Wed, 7 Dec 2022 17:52:29 -0500 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F012685662; Wed, 7 Dec 2022 14:52:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1670453549; x=1701989549; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=EHXrUzFqhtjrtp+2R9Fafu9ntu7u1UaPLUSfczdzlWE=; b=DClaJA0v7HFjSN6HKpvW/VK4O6LjOB9I+4aLVx/TRXAiBPaoANbEFI0C VCbQ2DhNeEMXvSfpsAZgk9DhN+qXRKsD8O+h5mihcjgQfBullDQkNr1II qQuy0+WSu5ulYiqTzaFxYG3a1jX8amIcOnLyIM1mRZs1MjiSpQ/xE3HdA 3UMcksGv5ECPBJsMpXi0OHjNvQmdQE1Stssgg4n7YNL62UXE1C5x/2cdb FqoiS7/36yPQzwKkt/7M1EGd7ReDXZyQbHrRktmgikYmTuWUWJhJOvWdB 7MTTndxNIB7Trt8I72fCoOiGLiC2NF0MXpNJ+hihzRTanQHbiJxTig7df Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10554"; a="300439516" X-IronPort-AV: E=Sophos;i="5.96,225,1665471600"; d="scan'208";a="300439516" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Dec 2022 14:52:27 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10554"; a="646781161" X-IronPort-AV: E=Sophos;i="5.96,225,1665471600"; d="scan'208";a="646781161" Received: from rchatre-ws.ostc.intel.com ([10.54.69.144]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Dec 2022 14:52:27 -0800 From: Reinette Chatre To: fenghua.yu@intel.com, dave.jiang@intel.com, vkoul@kernel.org, dmaengine@vger.kernel.org Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH V2 2/3] dmaengine: idxd: Prevent use after free on completion memory Date: Wed, 7 Dec 2022 14:52:21 -0800 Message-Id: <6c4657d9cff0a0a00501a7b928297ac966e9ec9d.1670452419.git.reinette.chatre@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE, SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751597724833131839?= X-GMAIL-MSGID: =?utf-8?q?1751597724833131839?= On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drv_disable_wq()->idxd_wq_free_resources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device. Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations") Suggested-by: Dave Jiang Signed-off-by: Reinette Chatre Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Cc: stable@vger.kernel.org --- Changes since V1: - Add Dave and Fenghua's Reviewed-by tags. - cc stable team (Fenghua). drivers/dma/idxd/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c index fcd03d29a941..b4d7bb923a40 100644 --- a/drivers/dma/idxd/device.c +++ b/drivers/dma/idxd/device.c @@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq) dev_warn(dev, "Clients has claim on wq %d: %d\n", wq->id, idxd_wq_refcount(wq)); - idxd_wq_free_resources(wq); idxd_wq_unmap_portal(wq); idxd_wq_drain(wq); idxd_wq_free_irq(wq); idxd_wq_reset(wq); + idxd_wq_free_resources(wq); percpu_ref_exit(&wq->wq_active); wq->type = IDXD_WQT_NONE; wq->client_count = 0;